Designing a Power Pages site securely is essential to prevent unauthorized data exposure and maintain the integrity of both internal and external user interactions. Below are secure design patterns you should implement when working with Dataverse data in Power Pages.
1. Use Table Permissions for All Data Access
Table Permissions are the foundation of data-level security in Power Pages.
- Define read, write, append, delete, create privileges.
- Apply conditions like “Only records where Created By = Current User”.
- Associate these permissions with appropriate Web Roles.
Example: If you’re showing a list of service tickets:
- Create a Table Permission for the Ticket table.
- Set the scope to “Contact” (show only the logged-in user’s tickets).
- Link it to a Web Role like “Authenticated User”.
2. Use Web Roles Effectively
Web Roles control access to:
- Table Permissions
- Web Pages
- Web Files
- Entity Lists and Entity Forms
Secure Design Pattern:
- Create roles like
CustomerUser,Manager,SupportAgent. - Assign roles automatically using Power Automate or via admin interface after registration.
- Avoid giving too many privileges to a generic “Authenticated Users” role.
3. Prefer Entity Forms and Lists Over Custom APIs (When Possible)
Entity Forms and Entity Lists in Power Pages automatically respect:
- Table Permissions
- Record-based security
- Business rules and plugins in Dataverse
This reduces the need to custom-code access control logic.
4. Secure Custom JavaScript and API Calls
If you’re using JavaScript to make calls to Web APIs, follow these principles:
- Never expose sensitive data in the browser.
- Secure custom Web APIs using Authorization headers and Token-based access.
- Validate user identity and role on the server side.
5. Use Web Page Access Control
Each Web Page in Power Pages can have Access Control Rules:
- Make pages public or private.
- Assign visibility based on Web Roles.
Pattern:
- Home and FAQ pages: Public
- Dashboard and Profile pages: Private (visible to authenticated roles only)
6. Avoid Hardcoded Logic in Liquid Templates
While Liquid is powerful, it runs server-side and can expose data if not controlled.
Bad:
{% assign allUsers = entities.contact %}
Good:
- Always use entity permissions and query only required fields and records.
- Hide sensitive logic behind a secured Web API or Power Automate flow.
7. Sanitize User Input
Whether using:
- Entity Forms
- Custom HTML forms
- JavaScript-enhanced forms
Ensure:
- Input validation is enforced
- Server-side validation via Power Automate, Plugins, or Dataverse validation rules
- CAPTCHA is enabled where appropriate (e.g., public forms)
8. Leverage Row-Level Security in Dataverse
You can configure Owner-based or Team-based row-level security. Combine this with Table Permissions to restrict visibility and access.
Use case:
- A regional manager can view tickets created only by users from their region.
9. Enable Auditing and Logging
Use:
- Dataverse auditing
- Portal telemetry via Application Insights
- Power Automate logging
To monitor and detect unauthorized access attempts or unusual behavior.
10. Token Expiry and Session Timeout
Configure Power Pages with:
- Appropriate session timeout policies
- Auto logout for inactivity
- Short-lived tokens for API interactions
Bonus Tip: Use Power Automate to Bridge Secure Access
Use flows to:
- Filter data based on user context
- Perform backend validation
- Avoid exposing sensitive data logic in the front-end
E.g., When a user submits a form, trigger a flow that:
- Checks user role
- Validates record ownership
- Inserts or updates records securely